PandoraNAS1. Operator and contact
PandoraNAS is a private home file storage client operated by Artur Korolev for invited family members aged 13 or older. Privacy, access, deletion and abuse requests: KristalZic@hotmail.com. A Google Play tester invitation and permission to access the home archive are separate controls. The app does not offer public account registration.
2. Data and purposes
To connect a phone, the home server processes the existing account username or invitation, display name, account role, device name, app-generated user/device identifiers, public device key and registration/revocation times. The default device name is the Android model and can be edited before connecting. Passwords are sent over HTTPS to verify access, are not saved on the phone, and are stored on the server only as salted password hashes. The private device key stays in Android Keystore; short-lived access sessions are kept in app memory. The app does not read IMEI, advertising ID, contacts, location, camera or microphone.
You can instead request device approval. The server receives the phone name, public key fingerprint and request times; the administrator compares the QR/device code and assigns an existing family profile. The QR contains a public identifier and cannot grant access by itself. Unapproved requests expire after 24 hours and are removed after a further 24 hours. Approved device registrations remain until revoked. After approval, a 4–12 digit PIN unlocks the app on this phone. The PIN is never sent to the server; a salted verifier and retry counters are encrypted using Android Keystore. Clearing app data removes this local protection and the device key and requires a new registration.
When you choose a file or folder using Android's file picker, its bytes, filename, file type, size, hashes and folder information are sent to the configured home server to store and retrieve your archive. File contents may include photos, videos, audio, documents and personal data, including embedded metadata such as location in a photo. Original metadata is not stripped. The app does not automatically scan or upload your gallery. Choosing a folder grants access to the selected folder and its contents for that transfer.
The server stores file ownership, versions, times, transfer state and operation history for reliable transfers, storage quotas, recovery and security. Activity history can include filenames, author identifiers and operation times. Technical diagnostics include operation identifiers, bytes, offsets, status and timing; they are not an advertising profile. A network address is necessarily visible to networking equipment and is temporarily used by the server's in-memory abuse limiter.
An in-app report or deletion request includes your account/device identifiers, selected subject identifier, message, time and request status. The archive operator uses it to investigate abuse or handle the requested action. Support email contains the information you choose to send and is also handled by the email providers involved.
3. Access and recipients
Files in the family area and related activity are visible to authorised family members. Personal areas are separated from other ordinary members, but the archive administrator can access personal files and metadata for administration and security; this is not end-to-end encrypted storage. Upload only material that you have the right to store and share. The current home connection uses encrypted HTTPS, directly at home or over the internet. The operator, the home storage and its backups can hold readable files. There are no integrated advertising, analytics or third-party tracking SDKs, and data is not sold.
Opening a file in another app grants that app temporary read access to the chosen copy. That app's own handling is outside PandoraNAS. Google Play and Android provide distribution, operating system services and their own diagnostics under their own policies; installing this app does not give the archive access to your Google password or Google account email.
4. Background transfers and local copies
A transfer starts only after your action. A foreground data-transfer service may continue the selected transfer when the app is in the background or the screen is off. Its notification may contain the filename and progress; visibility on the lock screen depends on Android settings. You can pause or stop transfers in the app and supported notification actions. Android or a lost connection can interrupt a transfer; the app may need to be reopened to resume it. Mobile data charges may apply.
The phone privately stores connection settings, a record of this policy acceptance, transfer history and recovery information including selected file URIs and names. Opened originals and thumbnails can be cached privately. Cache entries expire after 90 days without use and may be evicted sooner by space limits or Android. Thumbnails are limited to at most 1 GiB; originals to at most 64 GiB and 2,048 entries, also constrained by free space. This is a cache, not a guaranteed offline backup. Android app cloud backup and device transfer of app data are disabled.
5. Retention and deletion
Server files remain until deliberately removed. Moving a file to Trash does not erase it; permanent deletion is a separate action. Ordinary members cannot permanently delete other members' shared files. Account records, device registrations, activity/security history and resolved requests do not currently have an automatic expiry. The operator reviews retention and deletion requests individually and communicates what is removed, what must remain and why. Backups are separate copies and do not currently have an automated expiry schedule; deleting live data alone cannot promise immediate erasure from existing backups. A retention schedule and treatment of backups must be settled with the operator for your request.
Use “Request account or data deletion” in the app or email KristalZic@hotmail.com without having the app installed. Specify your existing archive login/display name and whether you request the entire account or particular data to be removed. Never send passwords, invitation codes or private keys. The operator verifies ownership using an existing family contact, then handles the account, device access, personal files, metadata and backups as applicable. Shared material and security/legal retention are reviewed separately, with reasons communicated to you. A request receipt or access revocation is not confirmation that data has been erased. See the deletion instructions for details.
Uninstalling the app or clearing its storage removes its local settings, key and private cached data, but does not delete files or the account on the home server. Copies exported to other apps or storage must be removed separately. Stopping use or withdrawing consent in the profile stops further app use until you choose to accept again; it does not by itself erase existing server data.
6. Choices, rights and changes
You can decline before connecting. Required account/security processing is necessary to provide this private service; selecting files for transfer is your choice. You can ask the operator for access, correction, a copy of your information, deletion or restriction, and raise a privacy complaint. Applicable rights and any right to complain to a supervisory authority depend on your location. If a user is under the local age for independent consent, a parent or guardian must authorise use. The app is not intended for children under 13. Material changes receive a new policy version and require a new in-app decision. Contact the operator if any statement does not match your home setup.